Avoid using your Alibaba Cloud account (root account) to access Blockchain as a Service (BaaS) directly. Instead, use RAM users or RAM roles with only the permissions they need.
Who this guide is for
| Role | What to do |
|---|---|
| Account administrator | Create RAM users with administrative rights, then use those RAM users to manage access for others |
| Service administrator | Create and manage RAM users or RAM roles for your team; enforce least-privilege permissions |
| Developer or operator | Use the RAM user or RAM role assigned to you; avoid embedding credentials in code |
RAM users
A RAM user is a real identity with long-term credentials — either a logon password (for console access) or an AccessKey pair (for API access). RAM users can be created by an Alibaba Cloud account or by RAM users and RAM roles that have administrative rights.
Security best practices
Separate administrative and service accounts
Create one RAM user with administrative rights to manage other RAM users. Keep individual user accounts separate from program accounts to prevent human errors from affecting automated workloads.
Grant least-privilege permissions
Grant each RAM user only the permissions required for their tasks. Least-privilege permissions limit the blast radius of misconfigurations and reduce the risk of permission abuse. See System policies for BaaS for the managed policies available for BaaS.
Protect credentials
Do not embed your AccessKey ID or AccessKey secret in code. Use Security Token Service (STS) tokens or environment variables to pass credentials at runtime instead.
Enable multi-factor authentication (MFA) for RAM users who access the RAM console.
Enable SSO for enterprise identity systems
Enable single sign-on (SSO) for RAM users to let them log in to Alibaba Cloud from your enterprise identity management system without managing separate credentials.
Create a RAM user
Use the RAM console or call API operations:
RAM console: Requires your Alibaba Cloud account username and password. Go to Overview of RAM users for step-by-step instructions.
API operations: Requires your AccessKey pair. See AccessKey security solution for secure credential handling.
RAM user groups
RAM user groups let you apply the same permissions to multiple RAM users at once, making permission management easier as your team grows.
Security best practices
Grant permissions to RAM user groups based on the principle of least privilege.
Remove a RAM user from a group when their role changes or they no longer need the group's permissions.
See Overview of a RAM user group for setup instructions.
RAM roles
A RAM role is a virtual identity with no permanent credentials — no logon password and no AccessKey pair. To use a RAM role, a trusted entity must assume the role. After assuming the role, the trusted entity gets a temporary STS token scoped to that role's permissions.
STS tokens expire automatically, which limits the exposure window if a token is compromised.
Security best practices
Minimize changes to trusted entities
Avoid changing a RAM role's trusted entity after creation. Removing a trusted entity can break workloads that depend on the role; adding one may introduce privilege escalation. Make sure that any changes are fully tested before you apply them.
Set an appropriate session duration
When a trusted entity calls AssumeRole, the resulting STS token is valid for at most the maximum session duration configured for the RAM role. Set this duration to the minimum time needed for the workload — shorter durations reduce the risk window if a token leaks.
The STS token's maximum validity period equals the longest session duration configured for the RAM role.
Enable SSO for enterprise identity systems
Enable SSO for RAM roles to let enterprise users assume the role directly from your identity management system. See Role-based SSO for configuration details.
Set up RAM roles
| Task | Reference |
|---|---|
| Understand RAM role concepts | RAM role overview |
| Assume a RAM role | Assume a RAM role |
| Configure session duration | Specify the maximum session duration for a RAM role |
Choose the right identity type
| Situation | Recommended identity |
|---|---|
| Human user accessing the console | RAM user with MFA |
| Automated program or service calling APIs | RAM role (with STS tokens) or RAM user with AccessKey pair stored in environment variables |
| Multiple users with the same job function | RAM user group |
| Cross-account or cross-service access | RAM role |
| Enterprise SSO integration | RAM user (user-based SSO) or RAM role (role-based SSO) |
What's next
Identities and permissions — broad overview of identity concepts in Alibaba Cloud
System policies for BaaS — ready-to-use managed policies for BaaS
RAM terms — definitions of RAM concepts
RAM limits — quotas and limits for RAM entities
Overview of user-based SSO — configure SSO for RAM users